Description

This article explains why an "Invalid Session Authentication Failed" message may be logged and what should be done to resolve the failure.

Symptoms

The following failure message is logged in Log Activity: "Invalid Session Authentication Failed events from SIM Audit-2."

Solution

These messages are seen when a browser tries to access an expired session token.

Restart the Tomcat Service.

  • In JSA 7.2.8, use the command, 'service tomcat restart'
  • In Qradar 7.3.x, use the command, 'systemctl restart tomcat'

Alternatively, from the JSA web user interface, click the Admin tab > Advanced > Restart Web Server.

Note: Look in the /var/log/audit/audit.log file to determine which IP address the session token is coming from.

Modification History

2019-10-10: Updated correct tomcat restart command for current code versions.
2019-07-09: Article reviewed for accuracy